Analysis of the Global Unified Threat Management (UTM) Market Enterprise Features and Product Value Propel Market Growth

Transcription

1 Analysis of the Global Unified Threat Management (UTM) Market Enterprise Features and Product Value Propel Market Growth November 2012

2 Research Team Lead Analyst Chris Rodriguez Industry Analyst Network Security Strategic Review Committee Leader Alpa Shah Vice President Information and Communication Technologies Research Director Jennifer Bates Research Director Information and Communication Technologies 2

3 Contents Section Slide Numbers Executive Summary 4 Market Overview 10 Total UTM Market - External Challenges: Drivers and Restraints 21 Forecast and Trends 28 Market Share and Competitive Analysis 40 Appliance Segment Breakdown 50 Virtual Appliance Segment Breakdown 62 Americas Breakdown 74 EMEA Breakdown 84 Asia-Pacific Breakdown 94 The Last Word 104 Appendix 108 3

4 Executive Summary 4

5 Executive Summary The Unified Threat Management (UTM) market is a high-growth market that is forecasted to grow at a rate of 17.3 percent from 2011 to UTM products are designed to consolidate multiple point security technologies into a single network appliance. UTM delivers value to customers in terms of space and energy efficiency, ease of deployment, and deeper discounting possible from a single vendor. This excellent product value has been most successful with small businesses and enterprise organizations with many remote or branch offices. As of 2012, there is little difference between UTM products and enterprise firewalls in terms of functionality because both now rely on a common operating system. Primarily, UTM products are designed for ease of use and lower costs instead of performance and reliability required by enterprise organizations. Reporting and management will be streamlined in UTM products and enterprise features such as clustering and acceleration may not be available. 5

6 Executive Summary (continued) The UTM market has shown strong and steady growth over the years owing to its strong value proposition. However, the market is growing increasingly competitive. Vendors must demonstrate ongoing product development efforts. Vendors must deliver new security functionality to better defend customers against the most sophisticated hacker threats. Vendors must develop virtual appliances to better defend customers virtual computing environments including public and private clouds and desktops. Virtual appliances will also increase adoption by MSSP and cloud-based service providers. 6

7 Executive Summary Market Engineering Measurements Market Overview Total UTM Market: Global, 2011 Market Stage Market Revenue Market Units/Volume Average Price Per Unit Market Size for Last Year of Study Period Growth $1,277.0 M 1,051 (000') $1,215 $2,832.9 M (2011) (2011) (2016) Base Year Market Growth Rate Compound Annual Growth Rate Customer Price Sensitivity Degree of Technical Change Market Concentration 16.6% 17.3% % (CAGR, ) (scale:1 [Low] to 10 [High]) (scale:1 [Low] to 10 [High]) (% of market share held by top 3 companies) Decreasing Stable Increasing For a tabular version, click here. Note: All figures are rounded. The base year is

8 Executive Summary Market Engineering Measurements (continued) Competitor Overview Total Addressable Market Number of Competitors Number of Companies that Exited* Number of Companies that Entered* Replacement Rate Attachment Rate 41 (active market competitors in base year) 2 (2011) 0 (2011) 3.5 Years (average period of unit replacement) 5.5 (current number of units per business 2011) Total Addressable Market Maximum Attachment Rate 10 (maximum potential number of units per business) Current Potential Users 350 M (attachment rate X number of businesses) Industry Advancement Average Product Development Time 1.7 Years Average R&D Spend by Product $3.5 M Marketing Spend as a Percent of Market Revenue 8.5% Decreasing Stable Increasing For a tabular version, click here. *Companies with revenue of more than $5.0 M. Note: All figures are rounded. The base year is

9 Executive Summary CEO s Perspective UTM provides essential security functions such as VPN, NGFW, content filtering, anti-virus, IPS, and anti-spam. Vendors are adding new security functions such as DLP, anti-ddos, anti-rootkit, WAF, and NAC. UTM products must support emerging enterprise technologies such as cloud computing and virtualization. There will be room for merger and acquisition activities in the UTM market. 5 UTM products are in demand in all vertical industries and globally. 9

10 Market Overview 10

11 Market Overview Definitions Technical Definitions A UTM product is a multi-function, next generation firewall solution that is optimized for small and medium sized businesses. There is little difference between UTM and enterprise firewalls in terms of functionality because these products usually share a common operating system. UTM products are based on more cost effective hardware, and are designed to be easier to deploy and manage compared to enterprise firewalls. Enterprise firewalls focus instead on scalability, reliability, performance, and centralized management. The basic functional requirements for UTM classification are stateful inspection, next generation firewall (NGFW), intrusion prevention system (IPS), virtual private networking (VPN), gateway anti-virus (AV), anti-spam, and Web content filtering. Stateful inspection allows customers to block traffic from unapproved sources. NGFW technology inspects and filters network traffic based on user identity, application type, and threat content. 11

12 Market Overview Definitions (continued) IPS blocks threats by inspecting traffic for known virus signatures or attack patterns. Internet Protocol Security (IPsec) VPN is a security protocol that enables users to remotely access the corporate network through a secure, encrypted connection. Secure Sockets Layer (SSL) VPN is more flexible than IPsec VPN and provides more granular control to specific applications. Gateway AV inspects network traffic for patterns that are associated with malicious software, also known as malware. Anti-spam filters out unsolicited messages. This prevents wasted IT resources and blocks social engineering attacks and malware. Content filtering software blocks user access to dangerous or objectionable Web sites. UTM subscriptions may include value-adding services such as Internet Protocol (IP) reputation monitoring and/or threat intelligence. IP reputation service blocks content from Web addresses that are known to send spam or host malicious software. 12

13 Market Overview Definitions (continued) The definition of UTM continues to expand as vendors add new functionality such as anti-bot software, distributed denial of service (DDOS) protection, and data leakage prevention (DLP). A DDOS attack is designed to block legitimate user access to essential data systems by flooding the network with illegitimate traffic. Anti-DDOS systems protect the network by detecting and blocking abnormal traffic. DLP software inspects outgoing network traffic for specific data patterns. This allows companies to prevent hackers or employees from leaking sensitive corporate data. Anti-bot technologies are used to detect and quarantine infected computers that are under hacker control. Virtual appliances provide business advantages such as reduced hardware costs, energy and space efficiency, and consolidation. Businesses can use virtualization to limit security breaches to the single virtual software instance instead of spreading throughout the network. 13

14 Market Overview Definitions (continued) Cloud computing is the practice of pooling computing resources and distributing this power to customers as needed. Businesses can use public clouds such as Amazon Elastic Compute Cloud (EC2) or Amazon Simple Storage Service (S3) to reduce their capital IT expenditures. Businesses can build a private cloud to reduce costs, simplify deployment and management, and improve accessibility. Bring-Your-Own-Device (BYOD) is a corporate IT strategy that encourages employees and guests to securely access the network with their personal or company-issued mobile devices. Mobile devices include smartphones, tablets, and laptops. 14

15 Market Overview Definitions (continued) Market Definitions UTM products may be delivered as hardware appliances or virtual appliances. Distributors are companies that sell UTM products to resellers. Value-added resellers (VARs) are resellers that provide expert recommendations on technology products and technical guidance to customers. This category also includes system integrators that install the product and offer service support for customers. Forecasts are based on vendor revenues. Channel partner revenues and original equipment manufacturer (OEM) revenues are not included to avoid double counting of market revenues. A unit refers to a single physical or virtual appliance sold to customers either directly or through a distribution channel. Price indicates the average product sale price and is provided in U.S. dollars ($). 15

16 Market Overview Definitions (continued) Enterprise generally refers to organizations with 1,000 employees and more. Small and medium size businesses (SMBs) have up to 999 employees. The Americas region includes countries in North America and South America. The Europe, Middle East, and Africa (EMEA) region includes high-growth countries in western and central Europe, Africa, and southwest Asia. Asia-Pacific includes countries such as Japan, Australia, China, and India. The financial market includes banks, credit unions, and insurance firms. The government market includes federal, state, and local government agencies. Healthcare includes hospitals, pharmaceutical companies, and other medical facilities. Retail and hospitality includes stores, restaurants, and hotels. The Others vertical market includes technology and telecommunications companies, educational institutions, manufacturers, and utility companies. 16

17 Market Overview Definitions (continued) Common Criteria (CC) for Information Technology Security Evaluation is an international standard for computer security certification. This standard enables security companies to define their security products capabilities. CC Evaluation Assurance Levels (EALs) 1 through 7 is a testing system to ensure that security products are effective at their claimed capabilities. Starting at 1, the numeric rating determines the rigor of product testing and the certification achieved. 17

18 Market Overview Key Questions This Study Will Answer What security functionality is necessary to protect SMB networks and data? How does UTM help SMB customers to comply with regulatory requirements? What product features are innovative and which are considered fundamental requirements? Which products provide excellent customer value? How are UTM products delivered to customers? What network environments can they support? Which vendors have strong products, roadmaps, and long-term strategies? What vertical markets and regional markets do UTM vendors focus on? 18

19 Market Overview Distribution Channels Distributors deliver UTM products to a wide range of customers through a global network of reseller partners and are essential for market growth. Total UTM Market: Distribution Channel Analysis, Global, 2011 Distributors 76.7% UTM Vendors 17.8% VARs Reseller partners 5.5% Direct Sales End User Note: All figures are rounded. The base year is

20 Market Overview Distribution Channel Discussion Distributors help UTM vendors to reach the broadest market possible. They receive deep discounting, price protection, and other assurances to sell the UTM product to thousands of reseller partners who then sell to their customers. A handful of large distributors such as Ingram Micro, Tech Data, and Arrow Electronics can generate the majority of vendor revenues. However, there are thousands of resellers in the UTM market. The VARs category also includes carriers or service providers who provide UTM solutions to the end-user customers as managed services. Direct sales are represented by either very small office customers through the vendor Web sites or by the largest organizations that request direct access to the vendor. 20

21 External Challenges: Drivers and Restraints Total UTM Market 21

22 Market Restraints Market Drivers Drivers and Restraints Total UTM Market: Key Market Drivers and Restraints, Global, Years 3-4 Years 5th Year Emerging technologies and sophisticated threats increase the potential risk of a security breach H H M New product features and security functions drive customer interest in UTM products H M M UTM products support new technologies enabling businesses to stay competitive M H H UTM consolidates multiple security products into a single product which increases its value to customers UTM s breadth of security functions enables efficient compliance with multiple industry and government regulations M M L L L L Increased competition from specialized vendors is due to the perception that point products provide better protection H H M UTM product prices are increasing and will cut into customers security budgets H M M Customers fear a single point of failure represented by the UTM convergence strategy M M L Customers security budget growth remains weak as the global economic recovery has been slower than expected L L L Impact: H High M Medium L Low Note: Drivers & Restraints are ranked in order of impact. 22

23 Drivers Explained Emerging Technologies and Sophisticated Threats Increase the Potential Risk of a Security Breach o Businesses are increasingly worried about ubiquitous security threats and the growing sophistication of hacking techniques. o Companies of all sizes are breached by hackers on a daily basis and receive much negative publicity in the ensuing media coverage. o Emerging technologies can be dangerous attack vectors if left unsecured. For example, physical firewalls lack the ability to inspect traffic between virtual servers. New Product Features and Security Functions Drive Customer Interest in UTM Products o UTM vendors add new functionality to their products such as anti-bot software, DLP, DDOS protection, and support for bring-your-own-device (BYOD) strategies. o Vendors develop these new technologies primarily to enable superior protection. o However, certain features such as Wide Area Network (WAN) optimization and virtual appliances provide enhanced user experience and operational efficiencies. o For example, vendors offer virtual appliances to provide increased network performance and easier deployment in remote or limited-space locations. 23

24 Drivers Explained (continued) UTM Products Support New Technologies Enabling Businesses to Stay Competitive o The rapid adoption of new enterprise technologies such as virtualization and cloud computing introduces new and untested attack vectors for hackers. o Traditionally, network firewalls have had limited visibility into the traffic between virtual machines. Now, UTM vendors offer virtual firewalls to inspect this traffic. o Businesses seek to adopt BYOD strategies but infected mobile devices can become network entry points for hackers. UTM products that can detect and apply policy to mobile devices will enable customers to increase productivity and connectivity. o NGFW enables businesses to control access to approved social media Web sites and applications. This helps businesses to pursue competitive IT strategies without increasing their business risk. UTM Consolidates Multiple Security Products into a Single Product which Increases its Value to Customers o Multiple security technologies are necessary to achieve a comprehensive network security system. UTM provides a wide breadth of security coverage. o UTM replaces several point products with a single, easy to deploy device. o Fewer appliances and fewer vendor partners reduces customers costs. 24

25 Drivers Explained (continued) UTM S Breadth of Security Functions Enables Efficient Compliance with Multiple Industry and Government Regulations o The Payment Card Industry Data Security Standard (PCI DSS) Requirement 1 specifically requires the use of network firewalls and drives market growth across all vertical industries. o The Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act define minimum data security requirements for the healthcare industry. o The Gramm-Leach-Bliley (GLB) Act defines the minimum security protection required from financial institutions including banks, securities firms, and insurance companies. o The North American Electric Reliability Corporation (NERC) was established as part of an effort to enhance cyber security for critical national infrastructure. o The National Institute of Standards and Technology (NIST) has developed standards such as the Federal Information Processing Standardization 140 (FIPS 140). o The European Union (EU) passed the EU Electronic Signature Directive and the EU Data Protection Directive to protect customer data. 25

26 Restraints Explained Increased Competition from Specialized Vendors is Due to the Perception that Point Products Provide Better Protection o In 2004, UTM functionality was originally based on open source software that lacked enterprise features or were built in-house. o Thus, certain UTM functions that require specialization such as anti-virus, were considered to be inadequate compared to those offered by point products. o This performance gap has decreased over the years as UTM vendors now have strong product development teams or license technology from companies such as Kaspersky or Sourcefire. UTM Product Prices are Increasing and will Cut into Customers Security Budgets o In recent years, UTM vendors have added many new product features based on increased research and development activity. o Prices are forecasted to increase steadily as a result of ongoing product development. o Higher product prices will temper unit shipment growth over the forecast period. 26

27 Restraints Explained (continued) Customers Fear a Single Point of Failure Represented by the UTM Convergence Strategy o UTM products perform many security capabilities that previously required extensive computing power distributed across many hardware appliances. o The full suite of UTM security functionality can overload an appliance s processing capabilities. Network performance is significantly degraded when customers enable the full suite of UTM functions. o Customers fear that UTM appliances will become a bottleneck for network traffic. o Customers cannot rely on a single UTM product as a hardware failure or software flaw would leave the organization defenseless. Alternatively, customers can deploy redundant devices or high availability products which adds to the total cost of ownership. Customers Security Budget Growth Remains Weak as the Global Economic Recovery has been Slower than Expected o Weak global economic conditions require that businesses spend less money. o Many security investments have been put on hold as security products have an intangible value. 27

28 Forecast and Trends Total UTM Market 28

29 Forecast Assumptions The forecast for UTM market revenue, unit shipments, and prices are based on the following assumptions: Global economic stability and eventual growth Steady or gradually declining hardware costs Continued or increased international expansion by product vendors High levels of research and development for new products and features from 2011 to 2014 Increasing adoption of virtualization, cloud computing, and mobile devices in SMB organizations The release of new cyber security requirements and legislation in 2013 and 2014 Existing customer subscription renewals, with most contracts lasting an average of three years Minimal market consolidation 29

30 Revenue ($ Million) Units (000') Total UTM Market Unit Shipment and Revenue Forecast The UTM market will maintain strong revenue growth resulting from increasing unit shipments and prices. 3,000.0 Total UTM Market: Unit Shipment and Revenue Forecast, Global, Revenue CAGR ( ) = 17.3% 2,500 2, ,000 2, , , ,500 1, Revenue , , , , , , ,832.9 Units ,051 1,197 1,373 1,566 1,777 2,011 Year 0 Note: All figures are rounded. The base year is

31 Unit Shipment and Revenue Forecast Discussion The UTM market is forecasted to grow at a CAGR of 17.3 percent from 2011 to Continued data breaches and cyber attacks will drive demand for UTM products throughout the forecast period. Renewed emphasis on data security will cause unit shipments to grow steadily from 2011 to The forecast is based on an assumption of increasing global economic stability in the future. This would allow businesses to increase their security spending. Though SMB organizations want new networking and security technologies, they will spread these investments over a longer period. As a result, the UTM market will continue to grow at a rapid rate late in the forecast period. Market revenues will grow the most in 2016 based on strong unit shipments and high product prices. 31

32 Average Price ($) Growth Rate (%) Total UTM Market Pricing Trends and Forecast The average UTM price is growing as vendors develop new security functionality and enterprise features. 1,600 1,400 1,200 Average Price for UTM Products Total UTM Market: Global, , Average Price 1,131 1,151 1,180 1,215 1,259 1,300 1,342 1,380 1,409 Growth Rate Year Note: All figures are rounded. The base year is

33 Pricing Trends and Forecast Discussion The average UTM price has been growing in recent years due to increased product development as vendors compete to release enterprise features. Enterprise features such as DLP, BYOD support, virtual appliances, anti-bot, DDOS prevention, and anti-rootkit require large product development budgets. UTM average price growth is offset by declining hardware and manufacturing costs. UTM products are targeted towards the SMB market. These organizations focus on value and will require more cost effective security solutions. As a result, the growth rate for average UTM price will peak in 2012 and then gradually decline through Therefore, the majority of revenue growth will be based on the increase in unit shipments rather than price. 33

34 Revenue (%) Total UTM Market Percent Revenue Forecast by Region The Americas region is an essential market place for UTM vendors while Asia-Pacific will capture the most market share Total UTM Market: Percent Revenue Forecast by Region, Global, 2011 and Asia-Pacific EMEA Americas Year Note: All figures are rounded. The base year is

35 Regional Percent Revenue Forecast Discussion The Americas region is the primary focus for UTM vendors. However, the Americas is a highly competitive market and can be difficult to penetrate for emerging vendors. The Asia-Pacific market is forecasted to grow rapidly through 2016 as businesses in the region continue to grow and expand operations with new branch offices. The EMEA region is forecasted to grow at the lowest rate of the three regions. Countries in this region are either suffering from distressed economies or are adversely affected by neighboring countries with struggling economies. As are result of differing CAGRs in each region, the Asia-Pacific will gain the most market share by 2016 while the EMEA region loses the most share. 35

36 Revenue (%) Total UTM Market Percent Revenue Forecast by Distribution Channel The UTM market s growth is due to strong support from distributors that enable access to thousands of reseller partners Total UTM Market: Percent Revenue Forecast by Distribution Channel, Global, Direct VARs Distributors Year Note: All figures are rounded. The base year is

37 Distribution Channel Discussion The UTM market relies on the support of thousands of reseller partners including distributors, VARs, authorized resellers, and OEM partners. Distributors are the key reseller type for UTM vendors. For many UTM vendors, a handful of large, multinational distributors can account for the majority of their product revenues. These distributors provide access to a large network of thousands of their reseller partners in exchange for a discounted price and other incentives. Direct sales to VARs, including systems integrators, are also an important distribution channel for UTM vendors. Direct sales will account for a nominal percentage of UTM sales by

38 Total UTM Market Percent Revenue by Vertical Market The UTM market provides security technologies that every industry requires. Percent of Revenue by Vertical Market Total UTM Market: Global, 2011 Financial 17.0% Others 43.0% Government 15.0% Retail/Hosp 12.0% Health 13.0% Note: Others include manufacturing, utilities, education, technology, telecommunications, and media. Note: All figures are rounded. The base year is

39 Vertical Market Percent Revenue Discussion UTM market revenues are very evenly distributed between vertical markets since all organizations require the foundational network security technologies provided by UTM products. The large market share held by the others category in 2011 is due to the demand for UTM products in many different types of organizations that are now connected to the Internet. The financial and government markets are the largest markets as these types of organizations have the most demanding security requirements and subsequently have very large budgets. The market share held by these vertical markets could be larger but financial and government organizations are concerned about UTM as a single point-of-failure. Financial organizations are most likely to invest in point products for best-of-breed protection. Point products also make it easier to maintain a separation of responsibilities between network administrators and security professionals. Retail and hospitality organizations are well represented in the UTM market because these organizations are typically characterized by distributed networks with many offices, stores, and remote locations. 39

40 Market Share and Competitive Analysis Total UTM Market 40

41 Competitive Analysis Market Share In 2011, Fortinet maintained the market leadership position in the UTM market while achieving strong growth in the enterprise firewall market. Percent of Revenue Total UTM Market: Global, 2011 Sophos 5.3% Others* 12.4% Fortinet 20.5% WatchGuard 7.9% Juniper Networks 12.1% Check Point 14.7% n = 41 Dell SonicWALL 13.4% Cisco 13.7% *A list of Other companies can be found in the appendix. Note: All figures are rounded. The base year is

42 Competitive Environment Total UTM Market: Competitive Structure, Global, 2011 Number of Companies in the Market Competitive Factors Key End-user Groups Major Market Participants 41 Price, value, ease of use and management, network performance, new security technologies, enterprise features Small offices, home offices, remote offices, branch offices, small businesses, medium size businesses Check Point, Cisco, Dell SonicWALL, Fortinet, Juniper Networks, McAfee, Sophos, WatchGuard Market Share of Top 3 Competitors 48.9% Other Notable Market Participants Distribution Structure Notable Acquisitions and Mergers Barracuda Networks, Clavister, Cyberoam, gateprotect AG, Global DataGuard, NETASQ, Network Box, Stonesoft, Trustwave Primarily two-tier through distributors, direct to VARs and authorized resellers, and nominal direct sales DeepNines was acquired and Tech Mahindra exited 42

43 Top Competitors Total UTM Market: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Check Point Many product features Unique product Companies that focus on Networking and IT and advanced protection licensing model can best-of-breed security and vendors that can offer capabilities confuse customers value discounted security products Cisco Strong reputation in Secondary focus on Large existing install base Specialized vendors with network technologies security products and bundled security cutting edge products and deals features Dell SonicWALL Primary focus on SMB Weak reputation in the Existing customers and Security vendors with customer needs and enterprise firewall new, small businesses more diversified product value market lines Fortinet Strong reputation in Hardware based SMB customers; large Network and IT UTM; wide breadth of technologies are less enterprise organizations companies that sell security coverage; strong scalable in virtual with remote or branch bundled security; name adoption by MSSP appliances offices brand point products partners 43

44 Top Competitors (continued) Total UTM Market: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Juniper Networks Reputation for high Enterprise focused and Large organizations and More affordable solutions performance products less focused on SMB existing customers with and quality networking requirements many branch or remote technologies offices McAfee Highly regarded IPS Lack of market awareness Existing customers; Bundled security and capabilities; of UTM and NGFW companies that require a networking solutions; comprehensive suite of capabilities wide breadth of security specialist vendors security technologies technologies Sophos Astaro acquisition Appliances not available Mid-market organizations; Network-focused security provides holistic for large enterprise and distributed networks; vendors; large IT vendors security coverage from data center deployments branch offices network to enterprise endpoints WatchGuard EAL 4+ certified; focus Slow adoption in the Small businesses; Specialized point product on SMB needs; enterprise space enterprise organizations vendors; bundled network excellent product value with smaller offices and security products 44

45 Top Competitors (continued) Total UTM Market: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Barracuda Provides excellent Lack of market awareness Primarily the SMB Low market visibility for Networks content filtering and of enterprise features and market; increasing focus UTM products NGFW capabilities capabilities on enterprise customers gateprotect AG Focus on ease of use; Lack of advanced security Small businesses; value- UTM vendors with more intuitive and powerful technologies including oriented and technically comprehensive product egui management DDOS prevention, DLP, unsophisticated lines including data center interface and NAC organizations appliances Global DataGuard Unique features such Lacks traditional NGFW Technically sophisticated Traditional UTM products as behavioral analysis, capabilities; unique organizations; high- and pure-play products vulnerability scanning, product set confuses security organizations and asset database customers NETASQ Excellent, patented NETASQ is best known in Value-oriented Large security vendors IPS capabilities; UTM EMEA but has had less businesses; organizations developing advanced includes real-time visibility in the Americas with a wide range of UTM security technologies vulnerability detection region security requirements and and risk management varying network sizes 45

46 Competitive Factors and Assessment Competitor Strategy Evaluation Total UTM Market: Global, 2011 Performance/ Ease of Use/ Management/ Product Breadth of Competitor Scalability Flexibility Reporting Marketing Cost/ Value Product Line Check Point Cisco Dell SonicWALL Fortinet Juniper Networks McAfee WatchGuard Key: Excellent Strong Average Weak 46

47 Competitive Factors and Assessment Explained Performance/ Scalability Enabling the full suite of UTM inspection functionality will greatly decrease network throughput rates. In a 10 Gbps firewall, the addition of IPS can decrease throughput to as little as 2-3 Gbps; full UTM functionality can decrease network performance to approximately 500 Mbps. Vendors must invest in quality hardware or utilize cloud computing for processor-intensive inspections. Ease of Use/ Flexibility SMB customers require products that are easy to deploy. Product licensing models must be easy to understand. Product and licensing flexibility enables customer to grow their networks and security strategies. Management/ Reporting SMB customers require streamlined but intuitive management capabilities. Technically unsophisticated businesses will require visual and Web-based management consoles. Role-based management and multi-tenant solutions can facilitate UTM adoption by MSSP partners. Marketing Vendors must educate customers in order to gain recognition for new product capabilities. Complex product licensing models are too difficult to communicate in a competitive market. Product Cost/ Value UTM products are oriented to meet the SMB market s needs. Total cost of ownership and product price are critical competitive factors in the UTM market. Breadth of Product Line UTM s value is primarily the ability to deploy multiple security technologies in a single device. A wide breadth of security services and product options is necessary to compete in the UTM market. Virtual appliances can provide deployment flexibility for customers and MSSP partners. 47

48 Meets Market Demands Competitive Factors and Assessment (continued) Competitive Landscape Total UTM Market: Global, 2011 Barracuda Networks Sophos Juniper Dell SonicWALL Check Point Fortinet WatchGuard Cisco Emerging Competitor Market Challenger Market Leader Market Penetration 48

49 Growth Rate ( ) Competitor Growth Analysis Fortinet and Check Point demonstrated stronger growth in the UTM market in recent years. Competitor Growth Analysis Total UTM Market: Global, 2011 Check Point Fortinet WatchGuard Dell SonicWALL Cisco Juniper Revenue ($ Million) Note: Bubble size represents relative capitalization. Note: All figures are rounded. The base year is

50 Appliance Segment Breakdown 50

51 Appliance Segment Breakdown The network appliance is the primary method of product delivery owing to ease of product deployment and purchasing. Important Segment Characteristics Factors Assessment Trend Opportunity Size ($ M) 1,223.8 Primary Needs Performance, reliability -- Price Sensitivity Medium-high Appliance Segment Percent Sales Breakdown, Global, 2011 Virtual Appliance 4.2% Appliance 95.8% Purchase Influencers Distribution Structure Demand for Innovation Network administrators Reseller partners Distributors, VARs, systems integrators, direct sales Medium Appliance Segment Percent Sales Breakdown, Global, 2016 Appliance 90.8% TREND Decreasing Stable Increasing Virtual Appliance 9.2% Note: All figures are rounded. The base year is

52 Appliance Segment Market Engineering Measurements Appliance Segment: Market Engineering Measurements, Global, 2011 Measurement Name Measurement Trend Segment Stage Growth --- Segment Revenue (2011) $1,223.8 M Segment Forecast (2016) $2,572.3 M Base Year Segment Growth Rate 15.5% Compound Annual Growth Rate (CAGR, ) 16.0% --- Price Sensitivity (scale of 1 to 10, Low to High) 8 Number of Competitors (active market competitors in base year) 41 Degree of Competition (scale of 1 to 10, Low to High) 7 Degree of Technical Change (scale of 1 to 10, Low to High) 7 Customer Loyalty (scale of 1 to 10, Low to High) 5 Segment Concentration (% of base year market controlled by top three competitors) 49.1% TREND Decreasing Stable Increasing Note: All figures are rounded. The base year is

53 Revenue ($ Million) Units (000') Appliance Segment Unit Shipment and Revenue Forecast Network appliances have been the primary method of product delivery for UTM vendors for years. Appliance Segment: Unit Shipment and Revenue Forecast, Global, Revenue CAGR ( ) = 16.0% 3, , , , , Revenue , , , , , , ,572.3 Units ,009 1,136 1,288 1,455 1,633 1,830 Year 2,000 1,800 1,600 1,400 1,200 1, Note: All figures are rounded. The base year is

54 Appliance Segment Unit Shipment and Revenue Forecast Discussion The UTM appliance market is forecasted to grow at a healthy rate as indicated by the CAGR of 16.0 percent. New small businesses, home offices, and remote branches will cause UTM appliance shipments to increase. Network appliances are easier to purchase, install, and maintain than enterprise software. Despite this strong growth, the appliance share of the UTM market will decrease to 90.8 percent of the market by The appliance segment s decline in market share is due to the rapid and growing adoption of virtual UTM appliances. Virtual UTM appliances are required to secure public cloud and virtual private data centers. Therefore, the virtual appliance segment will grow rapidly in direct relationship to adoption of virtual servers and endpoints in the enterprise network. 54

55 Average Price ($) Growth Rate (%) Appliance Segment Pricing Trends and Forecast UTM appliance prices will slightly increase over the forecast period to offset the development costs of new enterprise features. 1,600 Average Price for UTM Products Appliance Segment: Global, ,400 1, , Average Price 1,131 1,150 1,178 1,213 1,257 1,298 1,339 1,377 1,406 Growth Rate Year Note: All figures are rounded. The base year is

56 Appliance Segment Pricing Trends and Forecast Discussion The average price of UTM products is forecasted to grow during the forecast period because of the high product development costs associated with new security features. New security functions such NAC, WAF, anti-bot, anti-ddos, and virtual appliances require a larger product development budget and ultimately, higher product prices. UTM vendors also offer enterprise firewalls since most security functionality can be enabled in both types of products. This helps to offset the research and development costs of UTM products. Additionally, price growth is due to the use of higher quality hardware to support growing network bandwidth requirements. Organizations of all sizes require security products that can meet their ever-growing bandwidth requirements. The increase in UTM product performance requires more expensive hardware. However, this cost is offset by improvements in the manufacturing process and lower hardware costs. 56

57 Appliance Segment Market Share Fortinet maintains the leadership position in the UTM appliance market as the majority of its sales are network appliances. Percent of Revenue Appliance Segment: Global, 2011 WatchGuard 7.8% Sophos 5.3% Others* 12.1% Fortinet 21.0% Juniper Networks 12.2% Check Point 14.4% n = 41 Dell SonicWALL 13.5% Cisco 13.7% *A list of Other companies can be found in the appendix. Note: All figures are rounded. The base year is

58 Appliance Segment Competitive Environment Appliance Segment: Competitive Structure, Global, 2011 Number of Companies in the Segment 41 Competitive Factors Key End-user Groups Major Segment Participants Price, value, ease of use and management, network performance, features Small offices, home offices, remote offices, branch offices, small businesses, medium size businesses Barracuda Networks, Check Point, Cisco, Dell SonicWALL, Fortinet, Juniper Networks, McAfee, Sophos, WatchGuard Segment Share of Top 3 Competitors 49.1% Other Notable Segment Participants Distribution Structure Notable Acquisitions and Mergers Clavister, Cyberoam, gateprotect AG, Global DataGuard, NETASQ, Network Box, Stonesoft, Trustwave Primarily two-tier through distributors, direct to VARs and authorized resellers, and nominal direct sales DeepNines was acquired and Tech Mahindra exited 58

59 Appliance Segment Top Competitors Appliance Segment: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Barracuda Purpose built UTM Reputation as a content Heritage of SMB market Incumbent competitors in Networks appliance acquired filtering company; low success; distributed the enterprise market from phion AG UTM market visibility network environments moving downstream Check Point High performance Multiple UTM product Organizations requiring a Pure-play security UTM products support lines and brand names wide breadth of vendors in the enterprise future bandwidth causes market confusion deployment options offices requirements Cisco Full UTM functionality Cisco s low-end SA 500 Strong existing install Lack of advanced security available with each appliances lack the full base; UTM improves the features such as anti- ASA 5500 appliance; suite of UTM functionality effectiveness of a rootkit and DDOS additional hardware offered in the ASA line SecureX Architecture prevention not required Dell SonicWALL Supermassive project Low market visibility Expanded product line Best of breed security delivers massive outside of the UTM meets security needs for vendors with advanced computing power to market every size organization; security features protect the most Dell SecureWorks demanding networks customers 59

60 Appliance Segment Top Competitors (continued) Appliance Segment: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Fortinet Excellent product quality ASIC-based appliances Small businesses; Pure-play vendors with and performance; 10 are harder to update to distributed networks; extensive threat base UTM products meet changing security central offices; data databases offered requirements centers Juniper Networks Appliance reliability and Different product Branch offices of large Vendors with more cost performance; routing architectures from SRX distributed IT networks efficient appliances and networking protocol and SSG product lines support confuses customers McAfee Acquisition by Intel Reputation for endpoint Existing customers; Network-focused security provides McAfee with security with weak UTM embedded security and and IT vendors excellent hardware market visibility OEM partnerships performance capabilities WatchGuard Focus on SMB Reliance on third-party Small businesses; mid- Customer reliance on requirements including technologies demonstrates market; remote offices; pure-play products in the cost of ownership and less technical expertise branch offices data center integrated management 60

61 Meets Market Demands Appliance Segment Competitive Factors and Assessment Competitive Landscape Appliance Segment: Global, 2011 Dell SonicWALL Check Point Fortinet Barracuda Networks Sophos Juniper WatchGuard Cisco Emerging Competitor Market Challenger Market Leader Market Penetration 61

62 Virtual Appliance Segment Breakdown 62

63 Virtual Appliance Segment Breakdown The virtual appliance market is a small but high-growth segment of the UTM market. Important Segment Characteristics Factors Assessment Trend Opportunity Size ($ M) 53.2 Primary Needs Performance, reliability -- Price Sensitivity Medium Purchase Influencers Distribution Structure Demand for Innovation TREND Network administrators Reseller partners Distributors, VARs, systems integrators High Decreasing Stable Increasing Virtual Appliance Segment Percent Sales Breakdown, Global, 2011 Virtual Appliance 4.2% Appliance 95.8% Virtual Appliance Segment Percent Sales Breakdown, Global, 2016 Virtual Appliance 9.2% Appliance 90.8% Note: All figures are rounded. The base year is

64 Virtual Appliance Segment Market Engineering Measurements Virtual Appliance Segment: Market Engineering Measurements, Global, 2011 Measurement Name Measurement Trend Segment Stage Early Growth --- Segment Revenue (2011) $53.2 M Segment Forecast (2016) $260.6 M Base Year Segment Growth Rate 49.2% Compound Annual Growth Rate (CAGR, ) 37.4% --- Price Sensitivity (scale of 1 to 10, Low to High) 6 Number of Competitors (active market competitors in base year) 41 Degree of Competition (scale of 1 to 10, Low to High) 6 Degree of Technical Change (scale of 1 to 10, Low to High) 9 Customer Loyalty (scale of 1 to 10, Low to High) 4 Segment Concentration (% of base year market controlled by top three competitors) 47.3% TREND Decreasing Stable Increasing Note: All figures are rounded. The base year is

65 Revenue ($ Million) Units (000') Virtual Appliance Segment Unit Shipment and Revenue Forecast Growing demand for virtual UTM appliances will drive strong growth late in the forecast period. Virtual Appliance Segment: Unit Shipment and Revenue Forecast, Global, Revenue CAGR ( ) = 37.4% Revenue Units Year Note: All figures are rounded. The base year is

66 Virtual Appliance Segment Unit Shipment and Revenue Forecast Discussion The market for virtual UTM appliances will grow at a strong CAGR of 37.4 percent because of the security and operational benefits that virtualization offers. Virtual UTM appliances are necessary for customers that seek to inspect traffic between virtual machines. Virtual appliances allow customers to deploy multiple UTM firewalls on a single physical server. This provides space, energy, and cost savings for businesses and improves scalability. Therefore, the virtual appliance segment of the UTM market is forecasted to grow rapidly in relation to the strong adoption of virtualization in business networks. 66

67 Average Price ($) Growth Rate (%) Virtual Appliance Segment Pricing Trends and Forecast The prices for virtual UTM appliances will increase to be more similar to physical UTM appliances. 1,600 1,400 1,200 1,000 Average Price for UTM Products Virtual Appliance Segment: Global, Average Price 1,146 1,204 1,251 1,279 1,309 1,342 1,380 1,414 1,440 Growth Rate Year Note: All figures are rounded. The base year is

68 Virtual Appliance Segment Pricing Trends and Forecast Discussion Virtual UTM appliances may be deployed on customers choice of physical server. Therefore, the pricing for virtual appliances is not tied to hardware costs and consequently, is much more flexible than pricing for physical appliances. However, UTM vendors that price virtual appliances too aggressively may hurt sales of physical UTM appliances. The fluctuation in price growth rates from year to year is due to the UTM market s balancing of virtual appliance and physical appliance prices. Virtual UTM appliances must cover vendors research and development costs. 68

69 Virtual Appliance Segment Market Share Hardware expertise is less of a factor in the virtual UTM appliance market and represents an opportunity for new competitors to grow. Percent of Revenue Virtual Appliance Segment: Global, 2011 Sophos 5.1% Others* 14.5% Check Point 21.2% Fortinet 9.9% Cisco 13.2% n = 41 WatchGuard 11.5% Juniper Networks 11.7% Dell SonicWALL 12.9% *A list of Other companies can be found in the appendix. Note: All figures are rounded. The base year is

70 Virtual Appliance Segment Competitive Environment Virtual Appliance Segment: Competitive Structure, Global, 2011 Number of Companies in the Segment 41 Competitive Factors Key End-user Groups Major Segment Participants Price, value, ease of deployment, centralized management Remote offices, branch offices, medium size businesses Barracuda Networks, Check Point, Cisco, Dell SonicWALL, Fortinet, Juniper Networks, McAfee, Sophos, WatchGuard Segment Share of Top 3 Competitors 47.3% Other Notable Segment Participants Distribution Structure Notable Acquisitions and Mergers Clavister, Cyberoam, gateprotect AG, Global DataGuard, NETASQ, Network Box, Stonesoft, Trustwave Primarily two-tier through distributors, direct to VARs and authorized resellers, and direct sales DeepNines was acquired and Tech Mahindra exited 70

71 Virtual Appliance Segment Top Competitors Virtual Appliance Segment: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Barracuda Includes NGFW Reputation as a content Heritage of SMB market Incumbent competitors in Networks features acquired from filtering company; low success; distributed the enterprise market phion AG UTM market visibility network environments moving downstream Check Point Multiple virtual editions Multiple UTM product Organizations using public Pure-play security including security lines and brand names or private clouds and vendors in the enterprise gateway and secure causes market confusion virtualized environments offices virtual desktop Cisco Cisco ASA 1000V ASA 1000V appliances Strong existing install Lack of advanced security firewall offers flexible lack the full suit of security base; UTM improves the features such as anti- deployment, high functionality offered with effectiveness of a rootkit and DDOS availability, and secure physical appliances SecureX Architecture prevention cloud computing Dell SonicWALL Virtual appliances help Low market visibility Expanded product line Best of breed security customers to pursue outside of the UTM meets security needs for vendors with advanced more cost efficient IT market every size organization; security features strategies Dell SecureWorks customers 71

72 Virtual Appliance Segment Top Competitors (continued) Virtual Appliance Segment: SWOT Analysis, Global, 2011 Company Strengths Weaknesses Opportunities Threats Fortinet FortiManager and Virtual appliances benefit Small businesses; Pure-play vendors with FortiAnalyzer can less from ASIC-based distributed networks; extensive threat manage virtual and security functions central offices; data databases physical deployments centers Juniper Networks vgw Virtual Gateways Lack of virtual desktop Branch offices of large Vendors with more cost offer excellent scalability edition distributed IT networks efficient appliances and virtualizationspecific AV McAfee Well regarded Hardware advantages Existing customers; Network-focused security reputation for content provided by Intel are less embedded security and and IT vendors filtering, IPS, and effective for virtual OEM partnerships endpoint security appliances WatchGuard XTMv appliances Reliance on third-party Small businesses; mid- Customer reliance on provide multi-tenancy technologies demonstrates market; remote offices; pure-play products in the and granular policies less technical expertise branch offices data center needed by customers 72

73 Meets Market Demands Virtual Appliance Segment Competitive Factors and Assessment Competitive Landscape Virtual Appliance Segment: Global, 2011 Juniper Check Point Barracuda Networks Sophos WatchGuard Cisco Dell SonicWALL Fortinet Emerging Competitor Market Challenger Market Leader Market Penetration 73

74 Americas Breakdown 74

75 Americas Breakdown The Americas region includes the United States, Canada, Latin America, and South America. The Americas region has the largest share of UTM market revenue. Regional sales within the Americas are concentrated mostly in the United States and Canada. The Americas region is an important market for UTM vendors though the competition level is high. 75

76 Revenue ($ Million) Units (000') Americas Market Unit Shipment and Revenue Forecast UTM vendors primarily operate in the Americas region for the bulk of market revenues. 2, , , , , , UTM Market: Unit Shipment and Revenue Forecast, Americas, Revenue CAGR ( ) = 17.3% Revenue , , , ,719.0 Units ,079 1,220 Year 1,400 1,200 1, Note: All figures are rounded. The base year is